If anyone happens to read this… seems I had two things wrong:
1 – SETUP>HTTPS> I had added the WAN interface and a specific external IP to try to access ZS externally – DON’T do this, it doesn’t work, and it takes over entire the interface, 443 can no longer be used for anything else, hence we couldn’t access our exchange webmail.
2 – Switched from Cable modem to DSL modem, but hadn’t switched rules from ETH02 to ppp0.